afmtd Exploitable

Hello,

I have the same problem, any for help me? I have a active signature of bitdefender gravityzone.

Thanks.

I had the same problem. I found out that for all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely. Are you running Windows 10? If so, I would ignore the risk. Or use the workaround below at your own risk.

DisableATMFD registry key using a managed deployment ******

Please Note: This workaround works for Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, and Windows 8.1. ATMFD.DLL is not present in Windows 10 installations starting with Windows 10, version 1709.

Note Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. For information about how to edit the registry, view the "Changing Keys And Values" Help topic in Registry Editor (Regedit.exe) or view the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe.

1. Create a text file named ATMFD-disable.reg that contains the following text:

Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"DisableATMFD"=dword:00000001

1. Run regedit.exe.
2. In Registry Editor, click the File menu and then click Import.
3. Navigate to and select the** ATMFD-disable.reg** file that you created in the first step. (Note If your file is not listed where you expect it to be, ensure that it has not been automatically given a .txt file extension, or change the dialog’s file extension parameters to All Files).
4. Click Open and then click OK to close Registry Editor.
5. Restart the system.

As of today 5/19/2022, I am seeing this again. Anyone else?

I have too the same problem, my servers are fully patched